% !TEX TS-program = pdflatex
\documentclass[10pt, a4paper]{article}

\usepackage{a4wide}
\usepackage{color}
\usepackage{amsmath,amssymb,epsfig,pstricks,xspace}
\usepackage{german,graphics}
\usepackage{dsfont}
\usepackage{amsfonts}
\usepackage{graphics, psfrag}
\usepackage[latin1]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{enumitem} 
\usepackage{url}
\usepackage{array,dcolumn,booktabs}
\usepackage{pdflscape}
\usepackage{amsthm}
\usepackage{ulem}
\newcounter{task}
\newcommand{\task}{\stepcounter{task}\paragraph{Task \thetask~--~Solution\\}}

\usepackage{pifont}

\newcommand{\header}{
  \begin{center}
  \fbox{\parbox{11cm}{
    \begin{center}
      {\Large 7. Problem Session -- Solution\\ \vspace{0.2em}
        {\bf Secure Channels}\\ \vspace{0.7em} (Winter Term 2014/2015)\\
        \vspace{0.2em} \firstnameone \lastnameone\\
        \vspace{0.2em} \matriculationnumberone\\
        \vspace{0.2em} \firstnametwo \lastnametwo\\
        \vspace{0.2em} \matriculationnumbertwo \\
       \vspace{0.2em} \firstnamethree \lastnamethree\\
        \vspace{0.2em} \matriculationnumberthree
    }
    \end{center}
  }}
  \end{center}
}


%-------------------------------------------------------------------------------
%---------------------------- EDIT FROM HERE -----------------------------------
%-------------------------------------------------------------------------------

\newcommand{\firstnameone}{Jiaqi	}
\newcommand{\lastnameone}{Weng}
\newcommand{\matriculationnumberone}{115131}

\newcommand{\firstnametwo}{Vasilii	}
\newcommand{\lastnametwo}{Ponteleev}
\newcommand{\matriculationnumbertwo}{115151}

\newcommand{\firstnamethree}{Naveeni	}
\newcommand{\lastnamethree}{ Kumar Goswam}
\newcommand{\matriculationnumberthree}{113967}

\begin{document}
\pagestyle{plain}
\header


% number of tasks are automatically generated

\task
a)\\
Since Nonce = 0, $D = E_k(0) = L$ stays constant on each query.\\
(1) $q_1$ =  ($M_1$, $M_2$, $M_3$, $M_4$) $\rightarrow$ ($C_1$, $C_2$, $C_3$, $C_4$, T)\\
(2) $q_2$ =  ($M_1$, $M_2$, $M_3^{'}$, $M_4$) $\rightarrow$ ($C_1$, $C_2$, $C_3^{'}$, $C_4^{'}$, $T^{'}$)\\
$M_3 \ne M_3^{'}$\\
if $C_4$ = $C_4^{'}$ then real, else random.\\
Thus, this scheme is not RoR-OPRP-CPA secure.\\\\
b)\\
If IV = 0, then\\
(1) $q_1$ = (M) $\rightarrow$ ($C_1$), \\
where $C_1=E_k(M)$\\
(2) $q_2$ = (M, $M \oplus C_1$) $\rightarrow$ ($C_1$, $C_2$),\\
where $C_1=E_k(M)$, $C_2=E_k(M \oplus C_1 \oplus M \oplus C_1)=E_k(0)$\\
(3) $q_3$ = (M, $M \oplus C_1$, $M \oplus C2$) $\rightarrow$ ($C_1$, $C_2$, $C_3$),\\
where $C_1=E_k(M)$, $C_2=E_k(M \oplus C_1 \oplus M \oplus C_1)=E_k(0)$, $C_3=E_k(M \oplus C_2 \oplus M \oplus C_2)=E_k(0)$\\\\
if $C_2$ = $C_3$ then real, otherwise random.\\
Thus, this scheme is not RoR-OPRP-CPA secure.

\task
$\forall{i}  > 1:  C_i = C_{i + 1} \Leftrightarrow\\\\$
$\begin{cases}\mbox{ in } CV_i = \mbox{ in } CV_{i+1} \\ M_i = M_{i+1}   \end{cases} \Leftrightarrow\\\\$
$\begin{cases} M_{i-1} \oplus C_{i-1} = M_i \oplus C_i \\M_i = M_{i+1}  \end{cases} \Leftrightarrow\\\\$
$M_{i-1} \oplus C_{i-1} = M_{i+1} \oplus C_i$\\\\
So, if we choose $M_{i+1} = M_{i-1} \oplus C_{i-1} \oplus C_i$ on $i+1$ iteration we should get $C_i = C_{i+1}.$\\\\
As an example consider the following scenario in which we encrypt message M, which consists of blocks $M_i$, online.\\\\
$(i-1): M_{i-1} \rightarrow C_{i-1}$\\
$(i): M_i \rightarrow C_i,$\\
where $C_i = E_k(E_k(M_i) \oplus M_{i-1} \oplus C_{i-1})$\\
$(i + 1): M_{i+1} \rightarrow C_{i+1},$\\
where $M_{i+1} = M_{i-1} \oplus C_{i-1} \oplus C_i ,\mbox{  }  C_{i+1} =   E_k(E_k(M_{i+1}) \oplus M_{i} \oplus C_{i})$\\\\
if $C_i = C_{i+1}$ then real, else random.

\task
1) ( N, P1, ... ,PL) ==> (C1, ... , CL, Tag) \\
2) (N, C1, ... , CL+1, R) ==> (P1, ... ,Pm,z) (and then ( \_!\_ ) )\\
R is a random value and CL+1 =  tag\\
3)$(N1,P1^{'}, ... ,Pm^{'})$ ==> $(C1^{'}, ... , Cm^{'}, tag^{'})$ \\
$pm^{'}$== Z\\
4) forge $(C1^{'}, ... ,CM^{'})$ ($CM^{'}$ will be understood as the authentication tag and passes the authentication check) \\
\\
second version\\
so if adversary get the valid cipher pair (N, C, T), and he want to find the M\\
there are 2 cases,\\
1.\\
if Cl (C last byte) is n length, maybe he just send (N, C, T') (T' != T) to oracle, and get M'.\\
and M should = M'\\
2.\\
if |Cl| != n, so the Cl should pad by TagL,\\
adversary make the TagL' = TagL, and TagR' be random value, then send this ( N, C, T') (T=TagL'||TagR') to oracle, get M'.\\
and result M' = M.\\
\\
i do not know if this scenario is ok or not, because i have no idea about how to query another different C' to get M.\\
and i think using different (C, T') != (C,T) is also ok.\\

\end{document}
